{"id":182448,"date":"2026-07-03T22:53:39","date_gmt":"2026-07-03T20:53:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-paketnom-menedzhere-guix-dopuskayushhaya-udalyonnoe-vypolnenie-koda-v-sisteme"},"modified":"2026-07-03T22:53:39","modified_gmt":"2026-07-03T20:53:39","slug":"uyazvimost-v-paketnom-menedzhere-guix-dopuskayushhaya-udalyonnoe-vypolnenie-koda-v-sisteme","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-paketnom-menedzhere-guix-dopuskayushhaya-udalyonnoe-vypolnenie-koda-v-sisteme","title":{"rendered":"Zranitelnost v bal\u00ed\u010dkov\u00e9m spr\u00e1vci Guix, kter\u00e1 umo\u017e\u0148uje vzd\u00e1len\u00e9 spu\u0161t\u011bn\u00ed k\u00f3du v syst\u00e9mu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V bal\u00ed\u010dkov\u00e9m spr\u00e1vci Guix byly identifikov\u00e1ny zranitelnosti (CVE nebyly p\u0159id\u011bleny) v implementaci intern\u00edho p\u0159\u00edkazu «guix substitute», kter\u00fd je automaticky vyvol\u00e1v\u00e1n na pozad\u00ed procesem guix-daemon p\u0159i prov\u00e1d\u011bn\u00ed operac\u00ed instalace bal\u00ed\u010dk\u016f. Tento p\u0159\u00edkaz slou\u017e\u00ed k na\u010d\u00edt\u00e1n\u00ed ji\u017e zkompilovan\u00fdch bin\u00e1rn\u00edch bal\u00ed\u010dk\u016f z extern\u00edch server\u016f s ov\u011b\u0159en\u00edm jejich integrity pomoc\u00ed digit\u00e1ln\u00edho podpisu. Nejz\u00e1va\u017en\u011bj\u0161\u00ed zranitelnost umo\u017e\u0148uje vzd\u00e1len\u00e9 spu\u0161t\u011bn\u00ed k\u00f3du na syst\u00e9mu u\u017eivatele s privilegii, pod kter\u00fdmi b\u011b\u017e\u00ed proces guix-daemon. <\/p>\n

Probl\u00e9m se dot\u00fdk\u00e1 v\u0161ech konfigurac\u00ed s procesem guix-daemon, bez ohledu na to, zda je spu\u0161t\u011bn s pr\u00e1vy root nebo pod nezprivilegovan\u00fdm u\u017eivatelsk\u00fdm \u00fa\u010dtem. Pro zneu\u017eit\u00ed zranitelnosti sta\u010d\u00ed jak\u00fdkoliv pokus o sta\u017een\u00ed ji\u017e sestaven\u00fdch bin\u00e1rn\u00edch bal\u00ed\u010dk\u016f z serveru<\/a>, kter\u00e9 jsou pod kontrolou \u00fato\u010dn\u00edka. P\u0159i\u010dem\u017e \u0161kodliv\u00fd server<\/a> nemus\u00ed b\u00fdt nutn\u011b explicitn\u011b vybr\u00e1n nebo uveden v nastaven\u00ed u\u017eivatele — m\u016f\u017ee b\u00fdt definov\u00e1n pomoc\u00ed mo\u017enosti «—discover», co\u017e umo\u017e\u0148uje substituci serveru b\u011bhem MITM \u00fatoku. V konfigurac\u00edch, ve kter\u00fdch je guix-daemon spu\u0161t\u011bn s vy\u0161\u0161\u00edmi opr\u00e1vn\u011bn\u00edmi, m\u016f\u017ee m\u00edstn\u00ed u\u017eivatel prov\u00e9st \u00fatok, pokud m\u00e1 mo\u017enost p\u0159ipojen\u00ed k pozad\u00ed procesu p\u0159es Unix socket (standardn\u011b dostupn\u00fd pro v\u0161echny u\u017eivatele). <\/p>\n

Zranitelnost se nach\u00e1z\u00ed v obsluze «restore-file», kter\u00e1 se pou\u017e\u00edv\u00e1 k rozbalen\u00ed p\u0159i na\u010d\u00edt\u00e1n\u00ed bal\u00ed\u010dku, ani\u017e by \u010dekala na jeho kompletn\u00ed na\u010dten\u00ed a ov\u011b\u0159en\u00ed sta\u017een\u00e9ho archivu pomoc\u00ed digit\u00e1ln\u00edho podpisu. Probl\u00e9m je zp\u016fsoben nedostate\u010dnou kontrolou existence znak\u016f «.», «\\\/» a «..» v um\u00edst\u011bn\u00fdch v archivu cest\u00e1ch k soubor\u016fm. \u00dato\u010dn\u00edk m\u016f\u017ee p\u0159esunut\u00edm nespr\u00e1vn\u00fdch n\u00e1zv\u016f soubor\u016f do archivu doc\u00edlit z\u00e1pisu libovoln\u00e9ho souboru do jak\u00e9koli oblasti souborov\u00e9ho syst\u00e9mu, jak umo\u017e\u0148uj\u00ed opr\u00e1vn\u011bn\u00ed, pod kter\u00fdmi b\u011b\u017e\u00ed proces guix-daemon. <\/p>\n

Pro spu\u0161t\u011bn\u00ed sv\u00e9ho k\u00f3du v syst\u00e9mu lze nap\u0159\u00edklad p\u0159idat automaticky spustiteln\u00fd skript, jako je «~\\\/\\.bashrc» nebo ~\\\/\\.profile, nebo zm\u011bnit soubor ~\\\/\\.ssh\\\/authorized_keys s SSH kl\u00ed\u010di. Pokud je guix-daemon ve v\u00edcero u\u017eivatelsk\u00e9m syst\u00e9mu spu\u0161t\u011bn pod u\u017eivatelsk\u00fdm \u00fa\u010dtem root, \u00fato\u010dn\u00edk m\u016f\u017ee p\u0159epsat soubor s hesly nebo syst\u00e9mov\u00e9 skripty. <\/p>\n

Mo\u017enost vytv\u00e1\u0159en\u00ed podvr\u017een\u00fdch server\u016f pro \u0161\u00ed\u0159en\u00ed \u0161kodliv\u00fdch bal\u00ed\u010dk\u016f vznikla z toho, \u017ee proces stahov\u00e1n\u00ed metadat (narinfo) o dostupn\u00fdch bin\u00e1rn\u00edch bal\u00ed\u010dc\u00edch (fetch-narinfos) neprov\u00e1d\u011bl kontrolu certifik\u00e1tu serveru, spol\u00e9haj\u00edc na to, \u017ee hlavn\u00ed \u010d\u00e1st metadat byla podepsan\u00e1 digit\u00e1ln\u00edm podpisem. Jak se uk\u00e1zalo, podpis nepokr\u00fdval URL pro stahov\u00e1n\u00ed bal\u00ed\u010dku, co\u017e umo\u017enilo jeho podvr\u017een\u00ed, ani\u017e by do\u0161lo k poru\u0161en\u00ed integrity metadat. Nakonec by byl podvr\u017een\u00fd bal\u00ed\u010dek odm\u00edtnut kv\u016fli neproch\u00e1zen\u00ed kontroly jeho obsahu podle hash, kter\u00fd byl podeps\u00e1n digit\u00e1ln\u00edm podpisem, ale tato kontrola byla prov\u00e1d\u011bna a\u017e po f\u00e1zi rozbalen\u00ed, kde se projevoval probl\u00e9m se speci\u00e1ln\u00edmi znaky v n\u00e1zvech soubor\u016f. <\/p>\n

Krom\u011b p\u0159\u00edkazu «guix substitute» je zraniteln\u00fd zpracovatel «restore-file» zapojen do p\u0159\u00edkaz\u016f «guix offload», «guix archive —extract» a «guix challenge», co\u017e umo\u017e\u0148uje tak\u00e9 zneu\u017eit\u00ed zranitelnosti. Jako obranou proti zranitelnosti se doporu\u010duje v\u00fdslovn\u011b uv\u00e9st mo\u017enost «—no-substitutes» ve v\u0161ech p\u0159\u00edkazech guix. Oprava zranitelnosti byla p\u0159ijata do k\u00f3du Guix. U\u017eivatele se doporu\u010duje okam\u017eit\u011b nainstalovat aktualizace guix a guix-daemon, kter\u00e9 p\u0159ipravili v\u00fdvoj\u00e1\u0159i. <\/p>\n

Krom\u011b uveden\u00e9ho probl\u00e9mu bylo v Guix odstran\u011bno je\u0161t\u011b dal\u0161\u00ed t\u0159i zranitelnosti: <\/p>\n